At the moment, yes, the reverse proxy is the way to accomplish this. I'd argue that it's the best way to do so, anyway, as it leaves a security-sensitive job to a tool that's built for it. We'll have an improved authentication framework in nine, which will allow more granular and pluggable authentication. Dustin